Add relocation-hinted string reference detection with Capstone disassembly #41

Activity

1. unclesp1d3r

   added this to the v0.3 milestone on Sep 30, 2025
2. unclesp1d3r commented on Sep 30, 2025

   

   unclesp1d3r

   on Sep 30, 2025

   MemberAuthor

   More actions

   @coderabbitai Enhance this issue body with additional context and a proposed solution. Improve the issue title and assign the proper labels and other metadata.

   👀React with 👀1Reacted by coderabbitai
3. coderabbitai

   assigned

   unclesp1d3r

   on Sep 30, 2025
4. coderabbitai

   changed the title [-]Epic: v0.3[/-] [+]Add relocation-hinted string reference detection with Capstone disassembly[/+] on Sep 30, 2025
5. coderabbitai

   added

   enhancementNew feature or requestNew feature or request

   epicLarge feature or initiative spanning multiple tasksLarge feature or initiative spanning multiple tasks

   area:analyzerBinary analyzer functionalityBinary analyzer functionality

   lang:rustRust implementationRust implementation

   priority:highHigh priority taskHigh priority task

   needs:testsNeeds test coverageNeeds test coverage

   on Sep 30, 2025
6. coderabbitai commented on Sep 30, 2025

   

   coderabbitaiBot

   on Sep 30, 2025 – with coderabbitai

   Contributor

   More actions

   Tip

   For best results, initiate chat on the files or code changes.

   🧩 Analysis chain

   🏁 Script executed:

   #!/bin/bash
   # Get the details of issue #41
   gh issue view 41 --json title,body,labels,assignees,milestone,state,author
   

   Length of output: 381

   ---

   🏁 Script executed:

   #!/bin/bash
   # Read the README to understand the project
   cat README.md
   
   # Search for any documentation about relocation hints or Capstone
   fd -e md -e txt | head -20
   
   # Look for existing code related to relocation or Capstone
   rg -l "reloc|Capstone" --type rust --type python --type go -g '!target/**' | head -10
   

   Length of output: 6433

   ---

   🏁 Script executed:

   #!/bin/bash
   # Check for other issues in the v0.3 milestone
   gh issue list --milestone "v0.3" --json number,title,state
   
   # Look for any existing relocation-related code
   rg -n "reloc" -i -g '!target/**' -g '*.rs' -C 2 | head -50
   
   # Check for Capstone mentions in dependencies
   cat Cargo.toml | grep -i capstone -A 2 -B 2
   

   Length of output: 51

   ---

   🏁 Script executed:

   #!/bin/bash
   # Update the issue with enhanced content
   gh issue edit 41 \
     --title "Add relocation-hinted string reference detection with Capstone disassembly" \
     --body "## Overview
   
   This epic tracks the implementation of v0.3's core feature: using relocation information and lightweight disassembly to identify which extracted strings are actually referenced by executable code. This will significantly improve string ranking by prioritizing strings that are actively used versus those that are just sitting in data sections.
   
   ## Problem Statement
   
   Currently, StringyMcStringFace extracts strings from binary sections but doesn't distinguish between:
   - Strings that are actively referenced and used by the code
   - Dead strings that may have been left over from compilation
   - Data structure padding or unused literals
   
   This means the ranking system cannot prioritize truly relevant strings, leading to noise in the output.
   
   ## Proposed Solution
   
   ### Phase 1: Relocation-Based Hinting
   Parse relocation entries (ELF \`.rela\`/\`.rel\`, PE relocation table, Mach-O \`LC_DYLD_INFO\`) to identify data addresses that are referenced by the code. Mark extracted strings at these addresses with a \"referenced\" flag.
   
   **Benefits:**
   - Zero-cost for stripped binaries with relocation info
   - High confidence signal for ranking
   - No disassembly required for this subset
   
   ### Phase 2: Capstone Disassembly Pass
   For code sections (\`.text\`, etc.), perform a linear sweep using the [Capstone disassembly framework](https://www.capstone-engine.org/):
   1. Disassemble instructions in executable sections
   2. Identify data references (lea, mov with immediate addresses, etc.)
   3. Cross-reference with extracted string offsets
   4. Flag strings that are referenced by instructions
   
   **Scope for v0.3:**
   - **Simple linear sweep** (no control flow analysis)
   - **Flag only** - mark strings as \"referenced\" for ranking boost
   - **No CFG construction** - that's deferred to a future version
   - Support x86/x64 initially (ARM/AArch64 in later versions)
   
   ## Implementation Considerations
   
   ### Dependencies
   - Add \`capstone\` crate (Rust bindings to Capstone engine)
   - Ensure cross-platform support (Capstone has native libraries)
   
   ### Architecture Changes
   - Add \`referenced: bool\` field to \`ExtractedString\` struct
   - Create new \`analysis\` module for disassembly logic
   - Extend \`ContainerParser\` to extract relocation information
   - Update scoring algorithm to heavily weight referenced strings
   
   ### Performance
   - Make disassembly analysis **optional** via CLI flag (\`--analyze-references\` or similar)
   - Default to relocation-only for speed
   - Provide benchmarks comparing analysis on/off
   
   ### Testing
   - Unit tests with small crafted binaries containing known references
   - Test with stripped vs unstripped binaries
   - Verify behavior on ELF, PE, and Mach-O formats
   - Regression tests ensuring no false negatives for obvious references
   
   ## Success Criteria
   
   - [ ] Relocation entries are parsed from all three binary formats
   - [ ] Strings at relocation targets are flagged as \"referenced\"
   - [ ] Capstone integration successfully disassembles x86/x64 code sections
   - [ ] Data references in instructions are identified and cross-referenced
   - [ ] Referenced strings receive significant ranking boost
   - [ ] Analysis can be toggled via CLI flag
   - [ ] Documentation updated with new functionality
   - [ ] Performance impact is measured and acceptable (<2x slowdown for analysis mode)
   
   ## Out of Scope for v0.3
   
   - Control flow graph construction
   - Data flow analysis
   - Function boundary detection
   - Multi-architecture support beyond x86/x64
   - Indirect reference detection (pointers to string pointers)
   
   These features are candidates for v0.4 and beyond.
   
   ## Related Documentation
   
   - [Capstone Engine Documentation](http://www.capstone-engine.org/lang_rust.html)
   - ELF Relocation: [System V ABI](https://refspecs.linuxfoundation.org/elf/gabi4+/ch4.reloc.html)
   - PE Relocations: [Microsoft PE Format Spec](https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#the-reloc-section-image-only)
   - Mach-O Relocations: [Apple Mach-O Reference](https://github.com/aidansteele/osx-abi-macho-file-format-reference)
   
   ## Milestone
   
   This is the defining feature of the **v0.3 release**." \
     --add-label "enhancement" \
     --add-label "v0.3" \
     --add-label "epic" \
     --add-assignee "unclesp1d3r"
   
   # Verify the update
   gh issue view 41
   

   Length of output: 4372

   ---

   🏁 Script executed:

   #!/bin/bash
   # Check what labels exist in the repository
   gh label list
   
   # Add labels to the issue - try with existing labels or create if needed
   gh issue edit 41 --add-label "enhancement"
   
   # Try to add epic label
   gh issue edit 41 --add-label "epic" 2>&1 || echo "Epic label doesn't exist, will create it"
   
   # Create epic label if it doesn't exist and add it
   gh label create "epic" --description "Epic tracking issue spanning multiple features" --color "3E4B9E" 2>&1 || echo "Label might already exist"
   gh issue edit 41 --add-label "epic"
   
   # Verify the final state
   gh issue view 41 --json title,labels,assignees
   

   Length of output: 1570

   ---

   🏁 Script executed:

   #!/bin/bash
   # Add additional relevant labels
   gh issue edit 41 --add-label "area:analyzer"
   gh issue edit 41 --add-label "lang:rust"
   gh issue edit 41 --add-label "priority:high"
   gh issue edit 41 --add-label "needs:tests"
   
   # Show final result
   gh issue view 41 --json title,body,labels,assignees,milestone --jq '{title, labels: [.labels[].name], assignees: [.assignees[].login], milestone: .milestone.title}'
   

   Length of output: 471

   ---

   @unclesp1d3r I've successfully enhanced issue #41 with comprehensive details! Here's what was updated:

   ✅ Changes Made

   Title

   • Before: "Epic: v0.3"
   • After: "Add relocation-hinted string reference detection with Capstone disassembly"

   Body Enhancements

   Added detailed sections including:

   • Overview - Clear description of the v0.3 core feature
   • Problem Statement - Why this is needed (distinguishing referenced vs dead strings)
   • Proposed Solution - Two-phase approach:
     • Phase 1: Relocation-based hinting (ELF/PE/Mach-O relocation parsing)
     • Phase 2: Capstone disassembly with linear sweep (no CFG in v0.3)
   • Implementation Considerations - Dependencies, architecture changes, performance, and testing strategy
   • Success Criteria - Actionable checklist with 8 measurable goals
   • Out of Scope - Clear boundaries (CFG, data flow, multi-arch deferred to v0.4+)
   • Related Documentation - Links to Capstone docs and binary format specs

   Metadata

   • Labels added: enhancement, epic, area:analyzer, lang:rust, priority:high, needs:tests
   • Assignee: unclesp1d3r (maintained)
   • Milestone: v0.3 (already set)

   The issue now provides a clear roadmap for implementing relocation-based string reference detection with Capstone disassembly, making it actionable for development while setting appropriate scope boundaries for the v0.3 release.

   🔗 View the enhanced issue: #41
7. unclesp1d3r

   added a parent issue on Nov 10, 2025

   • Project: Stringy v1.0 Production Release #38
8. unclesp1d3r

   added the

   Epic

   issue type on Nov 10, 2025
9. unclesp1d3r

   removed the

   Epic

   issue type on Nov 10, 2025
10. unclesp1d3r

    added the

    Epic

    issue type on Nov 10, 2025
11. unclesp1d3r

    added sub-issues on Nov 10, 2025

    • Add relocation-based string ranking to identify code-referenced addresses #60
    • Implement Capstone Disassembly Pass to Identify Code-Referenced Strings #61
    • Epic: v0.2 - PE Resources, Symbol Demangling & Import/Export Enhancement #40
12. unclesp1d3r

    removed a sub-issue on Nov 10, 2025

    • Epic: v0.2 - PE Resources, Symbol Demangling & Import/Export Enhancement #40
13. coderabbitai

    added

    story-points: 2121 story points21 story points

    on Nov 12, 2025